RMF Considerations for Navy Industrial Control Systems Track 4 Session 2 Jeff Johnson Naval District Washington August [XX], 2017

Transcription

1 RMF Considerations for Navy Industrial Control Systems Track 4 Session 2 RMF Considerations for Navy Industrial Control Systems Track 4 Session 2 Jeff Johnson Naval District Washington August [XX], 2017 Tampa Convention Center Tampa, Florida

2 Ashore ICS HVAC and Utility Priorities Secure then C2 then SmartGrid Priorities Fiber Copper Wireless Radio Interim Secure Interim Secure Installation Communication Node Interim Secure PSNet Secure & Monitor Secure & Monitor 1. Enclave (Security) Secure & Monitor Inventory Interim Secure Secure & Monitor (Intra-Region Transport) Facility Engineering Operations Center 2. NUMCS (Hosting) 1. DoD Mission Assets 3. Supporting Infrastructure for Mission Assets 3. Smart Grid (Analytics & Monitoring) 2. Navy Priority Energy Buildings 4. Smart Grid (advanced monitoring and analytics) NIPRNET Cybersecurity of critical infrastructure is a major focus of the Shore Energy Exchange: Connect Collaborate Conserve

3 CNIC/ NAVFAC Joint Letter. Commander, Naval Facilities Engineering Command. As the functional authorizing official (FAO), NAVFAC will: (1) Be responsible and accountable, as the technical authority and security control assessor, for the authorization of all systems under their cognizance. (2) Ensure system design, development, and authorizations balance mission requirements and community risk. CNIC/Navy Regional Commanders. Assume overall responsibility and oversight for the execution of this effort within their respective Regions, which includes: (1) Inventory, assess, interim secure, secure, and continuously monitor all facility control systems on Navy installations. (2) Provide the Wide Area Network (PSNeT) and platform enclave (PE) for connecting control systems, which will be connected to PSNet. Energy Exchange: Connect Collaborate Conserve 3

4 Other Impacted Control Systems Fire Alarm Systems Access Control and Intrusion Detection Video Display and Analytics Systems Lighting Control Elevator Systems Energy Exchange: Connect Collaborate Conserve 4

5 Risk Management Framework Focus on Enterprise Architecture and Site Packages (Platform Enclave and Systems) NAVFAC is the Shore Technical Authority New Projects have RMF as part of design and acceptance DoD UFGS for new Construction or Renovations 5 Energy Exchange: Connect Collaborate Conserve

6 DoD RMF Process Energy Exchange: Connect Collaborate Conserve6

7 RMF Overview The basic process steps are similar to DIACAP but there are significant differences in several of the RMF process steps: Categorization using impact levels associated with Confidentiality, Integrity, and Availability (CIA) categories vice MAC/CL RMF has two process options Assess Only and Assess and Authorize Security controls are more granular than DIACAP IA Controls RMF has added Overlays for special assessment categories (e.g., Space, Cross Domain Solution, Classified) Impact levels change from Low/Medium/High to Low/Moderate/High and risk changes from Low/Medium/High to Very Low/Low/Medium/High/ Very High Energy Exchange: Connect Collaborate Conserve7

8 RMF Overview (Cont) Anticipate there will be considerably more resources required to perform the initial risk assessment (SCA) and final risk assessments (AO) on Security Controls. Escalation is mandatory for High and Very High Security Controls IATO s are no longer an accreditation vehicle, ATO s with conditions replace IATO' s but the criteria is slightly different Energy Exchange: Connect Collaborate Conserve8

9 DOD RMF IT Definitions DOD Information Technology has been divided into four forms: IS: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems. PIT: May consist of both hardware and software that is physically part of, dedicated to, or essential in real time to the mission performance of special purpose systems (i.e., platforms). PIT differs from products in that it is integral to a specific platform type as opposed to being used independently or to support a range of capabilities (e.g., major applications, enclaves or PIT systems). IT Services: IT services are outside the service user organization s authorization boundary, and the service user s organization has no direct control over the application or assessment of required security controls. DoD organizations that use IT services are typically not responsible for authorizing them (i.e., issue an authorization decision). IT Products: Products (including applications), are defined in DoDI as individual IT hardware or software items. They can be commercial or government provided and can include for example, operating systems, office productivity software, firewalls, and routers. Sources: RMF Knowledge Service: and CNSSI 4009 Energy Exchange: Connect Collaborate Conserve9

10 Question? 10 Energy Exchange: Connect Collaborate Conserve